Jrat — Office (OOXML) malware analysis

Static analysis result for SHA-256 4506ecca03e95671…

MALICIOUS

Office (OOXML)

614.9 KB Created: 2018-07-02 07:29:00 UTC Authoring application: Microsoft Office Word 12.0000 First seen: 2019-05-16
MD5: 928821c3a0984f92b4b6691ccd57877e SHA-1: 48eade70f2b99d92491786159c58ebf70ecf3809 SHA-256: 4506ecca03e95671bd6a65498c8afea537d89a13847e199f27b1045f07375ff4
162 Risk Score

Malware Insights

Jrat · confidence 95%

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file is identified as malicious by ClamAV with the signature Doc.Downloader.Jrat-6336393-1. Static analysis indicates the presence of an embedded OLE object (ooxml_oleobject_00.bin) which is a common vector for exploiting vulnerabilities like CVE-2026-21514. This embedded object likely serves to download and execute a secondary payload, consistent with the 'Downloader' classification in the ClamAV signature.

Heuristics 4

  • ClamAV: Doc.Downloader.Jrat-6336393-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Jrat-6336393-1
  • Embedded OLE object medium OOXML_OLE_OBJECT
    Document contains an embedded OLE object
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/markup-compatibility/2006 In document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/mathIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/wordprocessingml/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/word/2006/wordmlIn document text (OOXML body / shared strings)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
ooxml_oleobject_00.bin ooxml-ole-object OOXML embedded OLE part: word/embeddings/oleObject1.bin 1025024 bytes
SHA-256: 0a80fca9c344dc0c7cc4e86ec892f47e056024f1c346f2493af1b6bec39b3c95
Detection
ClamAV: Doc.Downloader.Jrat-6336393-1
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: SC_STR_URLDOWNLOAD, SC_MSF_REVERSE, SC_STR_VIRTUALALLOC Static shellcode analysis recovered API/import strings: wininet.dll, URLDownloadToFileA, LoadLibraryExA, VirtualAlloc, GetProcAddress, ExitProcess
emf_00.emf ooxml-emf OOXML EMF part: word/media/image1.emf 5560 bytes
SHA-256: b0fd45750f92eca463a6ac9f0e4a79321caa7eabd007a3f7f1690fafa11f0fa4

Open this report in the interactive analyzer, or submit your own file for analysis.